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IN THE CLAIMS 

1 . (Original) A method for gathering and monitoring the simultaneous status 
of nodes in a storage area network (SAN), comprising: 

receiving alert messages corresponding to status events in the storage 
area network, each status event having a corresponding event category and 
severity value; 

aggregating the alert messages according to event category and severity 
value to generate a category specific severity ranking of the alert messages; 

displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each 
chart entry having a node entry for each node having status attributable to the 
alert messages; and 

displaying, within at least one chart entry, node entries having a status 
event associated with the event category for that chart entry, the node entries 
displayed in the chart entry according to the severity ranking and each node 
entry indicative of a severity scale of status for the corresponding effected node. 

2. (Currently Amended) The method of claim 1 wherein displaying, within 
the at least one chart entry, comprises: 

accumulating events of each of a plurality of severity levels, each severity 
level representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node entry is an 
enumeration of events received for each of the plurality of severity levels within 
the severity ranking, the severity ranking determined by the severity scale for 
each node entry;-an4 

displaying the enumeration of events received for each node entry within 
the at least one chart entry containing that node entry, the enumeration of events 
received being displayed in an order according to the severity ranking ^ and 
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wherein the alert messages are received from remote agents operating 
within a storage area network. 

3. (Original) The method of claim 2 wherein the enumeration is a histogram 
having a magnitude based on the severity scale and a quantity of events within 
each severity level within the severity ranking. 

4. (Original) The method of claim 3 wherein the histogram has a plurality of 
visually overlapping elongated bar segments, each elongated bar segment 
corresponding to a particular severity level. 

5. (Original) The method of claim 1 further including discovering a topology 
of nodes in the SAN, wherein the alert messages correspond to status events for 
each of a plurality of selected nodes in a selection tree, the selection tree 
indicative of the nodes in the SAN. 

6. (Original) The method of claim 1 further including filtering the status 
events to compute a subset of elected events, wherein the received events 
correspond to elected events determined in response to predetermined filtering 
logic at the agents processing the elected events. 

7. (Original) The method of claim 1 wherein each chart entry has a 
magnitude axis, the magnitude axis indicative of a relative range of the quantity 
of status events within each of the severity levels corresponding to a plurality of 
node entries reflected in the chart entry. 

8. (Previously Presented) The method of claim 1 wherein each chart entry 
has a manageable entity axis, the manageable entity axis arranged, for each 
node, according to increasing severity scale denoting the severity ranking for 
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each node included in the chart entry, and further comprising computing the 
severity scale for each node according to a predetermined severity metric. 

9. (Original) The method of claim 1 wherein the severity level corresponds to 
a threshold value, the threshold value identifying triggering of an event having the 
corresponding severity level. 

10. (Original) The method of claim 1 wherein each event in an event category 
has a set of threshold values, the threshold values indicative of a quantitative 
metric triggering the particular event and severity. 

1 1 . (Original) The method of claim 1 0 further comprising processing and 
propagating the threshold values to remote agents, the remote agents operable 
to analyze nodes and determine when a particular metric satisfying a triggering 
threshold is attained and generate the corresponding event. 

12. (Original) The method of claim 1 wherein the nodes further comprise 
manageable entities, the manageable entities responsive to the server in a SAN 
and further including storage entities, connectivity entities, and database entities. 

13. (Original) The method of claim 1 further comprising selectively 
suppressing events of a particular category and severity. 

14. (Original) The method of claim 1 wherein the chart entries in the status 
array are further subdivided into chart entries directed to manageable entity 
health, manageable entity performance, and storage system capacity. 

15. (Original) The method of claim 1 comprising: 

receiving a selection of at least one node in a hierarchical 
arrangement of nodes; and 
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wherein receiving, aggregating, displaying a status array, and displaying, 
within at least one chart entry, node entries are performed in relation to the 
selected at least one node in order to display the simultaneous status of nodes in 
a storage area network. 

16. (Original) The method of claim 1 wherein: 

the status array is an N by M matrix of the plurality of chart entries, 
the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network; 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network; 

iii) a host chart entry indicating alert status of managed host entities 
in the storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network. 

17. (Original) The method of claim 1 further comprising 

receiving a user input corresponding to selection of at least one node 
entry from among the node entries displayed in the status array; 

displaying an expanded menu of status options for the selected entry; and 
receiving a response to the menus of status options and displaying an 
expanded status report corresponding to the expanded menu. 

18. (Original) A network monitoring device for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

a server having a correlator operable to receive alert messages 
corresponding to status events in the storage area network, each status event 
having a corresponding event category and severity value; 
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an aggregator operable to aggregate the alert messages according 
to event category and severity value to generate a category specific severity 
ranking of the alert messages; and 

an operator console operable to display a status array having a plurality of 
chart entries, each chart entry corresponding to alert messages of a particular 
event category and each chart entry having a node entry for each node having 
status attributable to the alert messages, the console further operable to display, 
within at least one chart entry, node entries having a status event associated with 
the event category for that chart entry, the node entries displayed in the chart 
entry according to the severity ranking and each node entry indicative of a 
severity scale of status for the corresponding effected node. 

1 9. (Currently Amended) The network monitoring device of claim 1 8 wherein 
the accumulator is further operable to: 

accumulate events of each of a plurality of severity levels, each severity 
level representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node entry is an 
enumeration of events received for each of the plurality of severity levels within 
the severity ranking, the severity ranking determined by the severity scale for 
each node entry;-an4 

display, within the at least one chart entry, the enumeration of events 
received for each node entry within the at least one chart entry containing that 
node entry, the enumeration of events received being displayed in an order 
according to the severity rank i nq. rankinq; 

wherein the enumeration is a histogram having a magnitude based on the 
severity scale and a quantity of events within each severity level within the 
severity ranking: and 
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wherein the histogram has a plurality of visually overlapping elongated bar 
segments, each elongated bar segment corresponding to a particular severity 
level. 

20. Canceled. 

21. Canceled. 

22. Canceled. 

23. Canceled. 

24. (Original) The network monitoring device of claim 18 wherein each chart 
entry has a magnitude axis, the magnitude axis indicative of a relative range of 
the quantity of status events within each of the severity levels corresponding to a 
plurality of node entries reflected in the chart entry. 

25. (Previously Presented) The network monitoring device of claim 18 
wherein each chart entry has a manageable entity axis, the manageable entity 
axis arranged, for each node, according to increasing severity scale denoting the 
severity ranking for each node included in the chart entry, and further comprising 
computing the severity scale for each node according to a predetermined 
severity metric. 

26. (Original) The network monitoring device of claim 18 wherein the severity 
level corresponds to a threshold value, the threshold value identifying triggering 
of an event having the corresponding severity level. 

27. (Currently Amended) The network monitoring device of claim 18 wherein 
each event in an event category has a set of threshold values, the threshold 
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values indicative of a quantitative metric triggering the particular event and 
severity ^ and 

wherein the server is further operable to processing and propagating the 
threshold values to remote agents, the remote agents operable to analyze nodes 
and determine when a particular metric satisfying a triggering threshold is 
attained and generate the corresponding event. 

28. Canceled. 

29. Canceled. 

30. (Original) The network monitoring device of claim 18 wherein the server is 
operable to selectively suppress events of a particular category and severity. 

31 . (Original) The network monitoring device of claim 18 wherein the chart 
entries in the status array are further subdivided into chart entries directed to 
manageable entity health, manageable entity performance, and storage system 
capacity. 

32. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to receive a selection of at least one node in a hierarchical 
arrangement of nodes, and display, within at least one chart entry, node entries 
in relation to the selected at least one node in order to display the simultaneous 
status of nodes in a storage area network. 

33. (Original) The network monitoring device of claim 18 wherein: 

the status array is an N by M matrix of the plurality of chart entries, 
the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network; 
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ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network; 

iii) a host chart entry indicating alert status of managed host entities 
in the storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network. 

34. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to: 

receive a user input corresponding to selection of at least one node entry 

from among the node entries displayed in the status array; 

display an expanded menu of status options for the selected entry; and 
display an expanded status report corresponding to the expanded menu 

and a response to the menu of status options. 

35. (Original) A computer program product having a computer readable 
medium operable to store computer program logic embodied in computer 
program code encoded thereon forgathering and monitoring the simultaneous 
status of nodes in a storage area network (SAN), comprising: 

computer program code for receiving alert messages 
corresponding to status events in the storage area network, each status event 
having a corresponding event category and severity value; 

computer program code for aggregating the alert messages 
according to event category and severity value to generate a category specific 
severity ranking of the alert messages; 

computer program code for displaying a status array having a plurality of 
chart entries, each chart entry corresponding to alert messages of a particular 
event category and each chart entry having a node entry for each node having 
status attributable to the alert messages; and 
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computer program code for displaying, within at least one chart entry, 
node entries having a status event associated with the event category for that 
chart entry, the node entries displayed in the chart entry according to the severity 
ranking and each node entry indicative of a severity scale of status for the 
corresponding effected node. 

36. Canceled. 

37. Canceled. 

38. (Previously Presented) The method of claim 1 , wherein the severity 
scale for each node entry is an aggregate value representative of a number of 
alert messages received at each node entry for a given sampling interval, 
wherein each node entry is weighted with respect to a corresponding severity 
level for each alert message, each severity level representing a range of severity 
values such that a given status event with a given severity value has a 
corresponding severity level when the given severity value of the given status 
event is within a range of severity values for the corresponding severity level. 

39. (Previously Presented) The network monitoring device of claim 18, 
wherein the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each node entry for a 
given sampling interval , wherein each node entry is weighted with respect to a 
corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level. 
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40. (Previously Presented) The computer program product of claim 35, 
wherein the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each node entry for a 
given sampling interval, wherein each node entry is weighted with respect to a 
corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level. 

41. Canceled. 

42. Canceled. 

43. (Currently Amended) A method forgathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

discovering a topology of not e s of nodes in the SAN , wherein the nodes 
comprise manageable entities, the manageable entities responsive to a server in 
the SAN and further including storage entities, connectivity entities, and database 
entities : 

propagating threshold values to remote agents, wherein responsive to the 
threshold values, the remote agents operable to analyze nodes and determine 
when a particular metric satisfying a triggering threshold is attained, and to 
generate a corresponding status event as an alert message; 

receiving alert messages, from the remote agents, corresponding to status 
events in the storage area network, each status event having a corresponding 
event category and severity value; 

storing status events in an event repository; 

aggregating the alert messages according to event category and severity 
value to generate a category specific severity ranking of the alert messages; 
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displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each 
chart entry having a node entry for each node having status attributable to the 
alert messages; and 

displaying, within at least one chart entry, node entries having a status 
event associated with the event category for that chart entry, the node entries 
displayed in the chart entry according to the severity ranking and each node 
entry indicative of a severity scale of status for the corresponding effected node, 
wherein the severity scale for a node entry is an enumeration of events received 
for each of a plurality of severity levels with the severity ranking. 

44. (Previously Presented) The method of claim 43 wherein the chart entries in 
the status array are further subdivided into chart entries directed to manageable 
entity health, manageable entity performance, and storage system capacity : and 

in response to a user request, the remote agents selectively suppressing 
events of a particular category and severity. 

45. (New) The method of claim 4, wherein displaying the enumeration of events 
includes displaying a histogram bar, for each node entry, that has a length 
proportional to a total number of status events corresponding to a node of the 
node entry. 

46. (New) The method of claim 45, wherein displaying the enumeration of 
events includes displaying each elongated bar segment indicating a quantity of 
status events corresponding to a corresponding severity level. 

47. (New) The method of claim 46, wherein each histogram bar has a maximum 
range that adjusts depending on a length of each histogram bar. 
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48. (New) The method of claim 7, wherein the magnitude axis of each chart 
entry has a maximum range that adjusts depending on a maximum value of the 
severity levels. 

49. (New) The method of claim 16, further comprising: 

receiving a selection of at least one node in the N by M status array matrix 
of the plurality of chart entries; 

wherein displaying the status array, includes simultaneously listing, for 
each category type, nodes having status events of and displaying, within at least 
one chart entry, node entries are performed in relation to the selected at least 
one node in order to display the simultaneous status of nodes in a storage area 
network; and 

wherein the nodes further comprise manageable entities, the manageable 
entities responsive to the server in a SAN and further including storage entities, 
connectivity entities, and database entities. 

50. (New) The method of claim 49, further comprising: 

accumulating events of each of a plurality of severity levels, each severity 
level representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node entry is an 
enumeration of events received for each of the plurality of severity levels within 
the severity ranking, the severity ranking determined by the severity scale for 
each node entry; 

propagating threshold values to remote agents, wherein responsive to the 
threshold values, the remote agents operable to analyze nodes and determine 
when a particular metric satisfying a triggering threshold is attained, and to 
generate a corresponding status event as an alert message; and 
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in response to a user request, the remote agents selectively suppressing 
events of a particular category and severity. 

51 . (New) The method of claim 50, wherein the enumeration is a histogram 
having a magnitude based on the severity scale and a quantity of events within 
each severity level within the severity ranking; and 

wherein each chart entry has a manageable entity histogram bar, the 
manageable entity histogram bar arranged, for each node, according to 
increasing severity scale denoting the severity ranking for each node included in 
the chart entry, and further comprising computing the severity scale for each 
node according to a predetermined severity metric. 

52. (New) The method of claim 51 , wherein each event in an event category 
has a set of threshold values, the threshold values indicative of a quantitative 
metric triggering the particular event and severity; and 

further comprising processing and propagating the threshold values to 
remote agents, the remote agents operable to analyze nodes and determine 
when a particular metric satisfying a triggering threshold is attained and generate 
the corresponding event. 



